PT-2025-19985 · Goshs · Goshs

Guilhem7 · Published 2025-05-06 · Updated 2025-05-20 · CVE-2025-46816

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions goshs versions 0.3.4 through 1.0.4

Description The issue allows anyone to execute commands on the server when goshs is run without arguments. This is due to the dispatchReadPump function not checking the -c option, allowing arbitrary command execution through websockets.

Recommendations For goshs versions 0.3.4 through 1.0.4, update to version 1.0.5 to resolve the issue. As a temporary workaround, consider disabling the dispatchReadPump function until a patch is available. Avoid running goshs without arguments to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Command Injection

Weakness Enumeration

CWE-284

CWE-77

Related Identifiers

CVE-2025-46816

GHSA-RWJ2-W85G-5CMM

GO-2025-3672

OPENSUSE-SU-2025:15135-1

Affected Products

Goshs

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46816.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46816 · Security Note
• https://osv.dev/vulnerability/GHSA-rwj2-w85g-5cmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46816 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3672 · Vendor Advisory
• https://github.com/patrickhener/goshs · Note
• https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm · Note
• https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa · Note
• https://suse.com/security/cve/CVE-2025-46331 · Note
• https://suse.com/security/cve/CVE-2025-46815 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Note
• https://suse.com/security/cve/CVE-2024-52290 · Note
• https://t.me/cvedetector/24640 · Telegram Post
• https://twitter.com/CVEnew/status/1919826354121457737 · Twitter Post